Linux Analysis Report
loligang.arm7

Overview

General Information

Sample Name: loligang.arm7
Analysis ID: 651258
MD5: 288e8dabaa23476987b7b953beb1e319
SHA1: ac59052889d6282c6c86abb9118aff243d0b4ed5
SHA256: a509e3b17d1efefa74540e9e27570cb98f42999881baca6cd4942c1c5ed4a8fe
Infos:

Detection

Mirai
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Contains symbols with names commonly found in malware
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection

barindex
Source: loligang.arm7 Avira: detected
Source: loligang.arm7 Virustotal: Detection: 63% Perma Link
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:45602 -> 139.59.109.181:1791
Source: /tmp/loligang.arm7 (PID: 6228) Socket: 0.0.0.0::23 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6228) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6228) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6228) Socket: 0.0.0.0::81 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6228) Socket: 0.0.0.0::8443 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6228) Socket: 0.0.0.0::9009 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) Socket: 0.0.0.0::81 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) Socket: 0.0.0.0::8443 Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) Socket: 0.0.0.0::9009 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 139.59.109.181
Source: unknown TCP traffic detected without corresponding DNS query: 76.64.177.212
Source: unknown TCP traffic detected without corresponding DNS query: 178.165.118.212
Source: unknown TCP traffic detected without corresponding DNS query: 103.7.215.153
Source: unknown TCP traffic detected without corresponding DNS query: 198.15.174.197
Source: unknown TCP traffic detected without corresponding DNS query: 45.13.59.133
Source: unknown TCP traffic detected without corresponding DNS query: 216.76.77.227
Source: unknown TCP traffic detected without corresponding DNS query: 112.186.250.68
Source: unknown TCP traffic detected without corresponding DNS query: 39.241.44.222
Source: unknown TCP traffic detected without corresponding DNS query: 250.129.247.102
Source: unknown TCP traffic detected without corresponding DNS query: 38.143.239.55
Source: unknown TCP traffic detected without corresponding DNS query: 193.212.17.109
Source: unknown TCP traffic detected without corresponding DNS query: 115.207.164.250
Source: unknown TCP traffic detected without corresponding DNS query: 179.49.120.173
Source: unknown TCP traffic detected without corresponding DNS query: 161.59.111.98
Source: unknown TCP traffic detected without corresponding DNS query: 133.37.119.128
Source: unknown TCP traffic detected without corresponding DNS query: 120.8.186.192
Source: unknown TCP traffic detected without corresponding DNS query: 113.95.4.38
Source: unknown TCP traffic detected without corresponding DNS query: 58.157.157.44
Source: unknown TCP traffic detected without corresponding DNS query: 176.75.22.31
Source: unknown TCP traffic detected without corresponding DNS query: 114.6.103.195
Source: unknown TCP traffic detected without corresponding DNS query: 113.171.122.115
Source: unknown TCP traffic detected without corresponding DNS query: 123.149.103.18
Source: unknown TCP traffic detected without corresponding DNS query: 83.192.49.152
Source: unknown TCP traffic detected without corresponding DNS query: 96.1.17.14
Source: unknown TCP traffic detected without corresponding DNS query: 247.112.198.170
Source: unknown TCP traffic detected without corresponding DNS query: 151.105.55.144
Source: unknown TCP traffic detected without corresponding DNS query: 13.250.60.254
Source: unknown TCP traffic detected without corresponding DNS query: 204.176.35.80
Source: unknown TCP traffic detected without corresponding DNS query: 68.167.102.125
Source: unknown TCP traffic detected without corresponding DNS query: 39.43.41.130
Source: unknown TCP traffic detected without corresponding DNS query: 111.229.26.140
Source: unknown TCP traffic detected without corresponding DNS query: 45.86.67.31
Source: unknown TCP traffic detected without corresponding DNS query: 53.46.52.97
Source: unknown TCP traffic detected without corresponding DNS query: 13.123.82.113
Source: unknown TCP traffic detected without corresponding DNS query: 142.185.91.38
Source: unknown TCP traffic detected without corresponding DNS query: 1.82.7.12
Source: unknown TCP traffic detected without corresponding DNS query: 175.229.150.209
Source: unknown TCP traffic detected without corresponding DNS query: 250.206.123.186
Source: unknown TCP traffic detected without corresponding DNS query: 135.254.86.35
Source: unknown TCP traffic detected without corresponding DNS query: 136.150.57.0
Source: unknown TCP traffic detected without corresponding DNS query: 176.88.152.151
Source: unknown TCP traffic detected without corresponding DNS query: 42.1.171.176
Source: unknown TCP traffic detected without corresponding DNS query: 72.233.147.136
Source: unknown TCP traffic detected without corresponding DNS query: 209.164.60.243
Source: unknown TCP traffic detected without corresponding DNS query: 86.255.50.76
Source: unknown TCP traffic detected without corresponding DNS query: 19.21.208.57
Source: unknown TCP traffic detected without corresponding DNS query: 62.50.255.23

System Summary

barindex
Source: loligang.arm7, type: SAMPLE Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: loligang.arm7, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_app.c
Source: ELF static info symbol of initial sample Name: attack_app_http
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_get_opt_str
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_method.c
Source: ELF static info symbol of initial sample Name: attack_method_asyn
Source: ELF static info symbol of initial sample Name: attack_method_greip
Source: loligang.arm7, type: SAMPLE Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: loligang.arm7, type: SAMPLE Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: loligang.arm7, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: loligang.arm7, type: SAMPLE Matched rule: MAL_ARM_LNX_Mirai_Mar13_2022 date = 2022-03-16, hash1 = 0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68, author = Mehmet Ali Kerimoglu a.k.a. CYB3RMX, description = Detects new ARM Mirai variant
Source: 6235.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6229.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6226.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6228.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: loligang.arm7 ELF static info symbol of initial sample: __gnu_unwind_execute
Source: loligang.arm7 ELF static info symbol of initial sample: scanner.c
Source: loligang.arm7 ELF static info symbol of initial sample: scanner_init
Source: loligang.arm7 ELF static info symbol of initial sample: scanner_pid
Source: loligang.arm7 ELF static info symbol of initial sample: scanner_rawpkt
Source: /tmp/loligang.arm7 (PID: 6228) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) SIGKILL sent: pid: 6228, result: successful Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: classification engine Classification label: mal100.troj.linARM7@0/0@0/0
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2275/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/6193/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1335/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/910/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/912/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/912/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/912/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/759/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/759/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/759/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/6228/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/517/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/918/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/918/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/918/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2285/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2281/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/761/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/761/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/761/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1622/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/884/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/884/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/884/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1983/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2038/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1586/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1465/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1344/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1860/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1463/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2156/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/800/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/800/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/800/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/801/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/801/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/801/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1629/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1627/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1900/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/491/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/491/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/491/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2294/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2050/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1877/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/772/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/772/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/772/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1633/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1599/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1632/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1477/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/774/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/774/fd Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6234) File opened: /proc/774/exe Jump to behavior
Source: /tmp/loligang.arm7 (PID: 6226) Queries kernel information via 'uname': Jump to behavior
Source: loligang.arm7, 6226.1.000000007380f233.000000001ab6ca97.rw-.sdmp, loligang.arm7, 6228.1.000000007380f233.0000000050387bb9.rw-.sdmp, loligang.arm7, 6229.1.000000007380f233.0000000050387bb9.rw-.sdmp, loligang.arm7, 6235.1.000000007380f233.0000000050387bb9.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: loligang.arm7, 6226.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6228.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6229.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6235.1.0000000078068229.0000000079bc9c10.rw-.sdmp Binary or memory string: Wx86_64/usr/bin/qemu-arm/tmp/loligang.arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/loligang.arm7
Source: loligang.arm7, 6226.1.000000007380f233.000000001ab6ca97.rw-.sdmp, loligang.arm7, 6228.1.000000007380f233.0000000050387bb9.rw-.sdmp, loligang.arm7, 6229.1.000000007380f233.0000000050387bb9.rw-.sdmp, loligang.arm7, 6235.1.000000007380f233.0000000050387bb9.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: loligang.arm7, 6226.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6228.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6229.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6235.1.0000000078068229.0000000079bc9c10.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

barindex
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: loligang.arm7, type: SAMPLE
Source: Yara match File source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY

Remote Access Functionality

barindex
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: loligang.arm7, type: SAMPLE
Source: Yara match File source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs